CVE-2021-27562

trustedfirmware trusted firmware-m

Published 25 May 2021 · updated 17 Jun 2026 · Analyzed

5.5 Medium · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 17 Nov 2021 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.

References

developer.arm.com/support/arm-security-updates · Vendor Advisory
git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/svc_caller_sp_fetching_vulnerability.rst · Permissions Required, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27562 · US Government Resource